)]}'
{"specs/backlog/policy-rule-namespacing.rst":[{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"fd349fe0c58be5218c5b2030ecff80ed1e68c09e","unresolved":false,"context_lines":[{"line_number":39,"context_line":"the cloud-wide nova policy file, and maybe override a few that were"},{"line_number":40,"context_line":"important to restrict since this was a production endpoint."},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Further, policy files lower down the hierarchy can refer to rules in their"},{"line_number":43,"context_line":"ancestors, for example, in a nova endpoint in a production region, might"},{"line_number":44,"context_line":"have the following rule:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"\"compute:create\": \"service.nova.compute:create and role:production_deployer\""}],"source_content_type":"text/x-rst","patch_set":2,"id":"7aa08908_57baa60b","line":43,"range":{"start_line":42,"start_character":0,"end_line":43,"end_character":9},"updated":"2016-06-09 10:46:21.000000000","message":"Why not just inherit down the missing rules (the rules that have not been defined/overridden) from their ancestors?","commit_id":"561463d4d2c99ae8e5d49d181e220baedab14160"},{"author":{"_account_id":6460,"name":"Brad Topol","email":"btopol@us.ibm.com","username":"btopol"},"change_message_id":"34dc1cb5e3191969977ae2361a357df60307f7f1","unresolved":false,"context_lines":[{"line_number":43,"context_line":"ancestors, for example, in a nova endpoint in a production region, might"},{"line_number":44,"context_line":"have the following rule:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"\"compute:create\": \"service.nova.compute:create and role:production_deployer\""},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"The \u0027service.nova\u0027 allows this policy file to access the namespace of rules"},{"line_number":49,"context_line":"defined in the policy defined for this service in keystone."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dab17558_bc134cb7","line":46,"updated":"2016-05-10 17:27:47.000000000","message":"I very much appreciate that you provided an example here. Very helpful!","commit_id":"561463d4d2c99ae8e5d49d181e220baedab14160"},{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"636041a8e1b9530deee01030b9ccb43dd90b2a9c","unresolved":false,"context_lines":[{"line_number":52,"context_line":"could contain cross-service rules that can be inherited or referenced by all."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"This proposal requires, however, that the other project services start"},{"line_number":55,"context_line":"utilizing the existing keystone centralized policy APIs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"},{"line_number":58,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"9abb7d3a_5c85ca57","line":55,"updated":"2016-06-01 16:37:07.000000000","message":"This should be documented as a dependency.","commit_id":"561463d4d2c99ae8e5d49d181e220baedab14160"},{"author":{"_account_id":17860,"name":"Samuel de Medeiros Queiroz","email":"samueldmq@gmail.com","username":"samueldmq"},"change_message_id":"fd349fe0c58be5218c5b2030ecff80ed1e68c09e","unresolved":false,"context_lines":[{"line_number":51,"context_line":"Further, it may be beneficial to define a top level \u0027cloud\u0027 namespace, that"},{"line_number":52,"context_line":"could contain cross-service rules that can be inherited or referenced by all."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"This proposal requires, however, that the other project services start"},{"line_number":55,"context_line":"utilizing the existing keystone centralized policy APIs."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Alternatives"},{"line_number":58,"context_line":"------------"}],"source_content_type":"text/x-rst","patch_set":2,"id":"7aa08908_b772eaae","line":55,"range":{"start_line":54,"start_character":0,"end_line":55,"end_character":56},"updated":"2016-06-09 10:46:21.000000000","message":"Yes, and I don\u0027t think this is going to be the case anytime soon. Policy priorities (cross-project) are different at this point. There is an effort to generate the policy file from the rules defined in the code, which is a first step for policy improvement.\n\nI believe this is something good, in long-term, but is not a priority right now.","commit_id":"561463d4d2c99ae8e5d49d181e220baedab14160"}]}